Detection: Cisco ASA - Logging Message Suppression

Updated Date: 2025-11-18 ID: 4e6c9d2a-8f3b-4c7e-9a5f-2d8b6e1c4a9f Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command. Adversaries may suppress specific log message IDs to selectively disable logging of security-critical events such as authentication failures, configuration changes, or suspicious network activity. This targeted approach allows attackers to evade detection while maintaining normal logging operations that might otherwise alert administrators to complete logging disablement. The detection monitors for command execution events (message ID 111008 or 111010) containing the "no logging message" command, which is used to suppress specific message IDs from being logged regardless of the configured severity level. Investigate unauthorized message suppression, especially suppression of security-critical message IDs (authentication, authorization, configuration changes), suppression performed by non-administrative accounts, during unusual hours, or without documented justification.

Search

 1`cisco_asa`
 2message_id IN (111008, 111010)
 3command = "no logging message *"
 4
 5| fillnull
 6
 7| stats count
 8        earliest(_time) as firstTime
 9        latest(_time) as lastTime
10        values(user) as user
11        values(action) as action
12        values(message_id) as message_id
13        values(command) as command
14        values(src_ip) as src_ip
15        values(process_name) as process_name
16  by host
17
18| `security_content_ctime(firstTime)`
19
20| `security_content_ctime(lastTime)`
21
22| `cisco_asa___logging_message_suppression_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco ASA Logs	Other	`'cisco:asa'`	`'not_applicable'`

Macros Used

Name	Value
cisco_asa	`sourcetype=cisco:asa`
cisco_asa___logging_message_suppression_filter	`search *`

cisco_asa___logging_message_suppression_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1562.002	Disable Windows Event Logging	Defense Evasion
T1070	Indicator Removal	Defense Evasion

Exploitation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010. If your logging level is set to 'notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Admins may suppress verbose messages to reduce log volume or manage storage. Verify against change management and logging policies. Establish baseline of approved suppressed message IDs.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

User $user$ executed command $command$ to suppress specific logging message ID on Cisco ASA host $host$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
user	user	50	command
host	system	50	command

References

https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:asa`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:asa`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1